Get Certified as a Sumo Security Power User! With security threats on the rise, come join our Security and Compliance experts to learn how Sumo Logic’s Threat Intelligence can help you stay on top of your environment by matching IOCs like IP address, domain names, URL, email addresses, MD5 hashes and more, to increase velocity and accuracy of threat detection. Hands on labs help cement the knowledge learned.

1. Become a
Sumo Security User
Security Certification

2. Sumo Logic Confidential
Become a Sumo Security Power User
1. Learn How Security Analytics works for you
2. Develop a Toolset for Basic and Advanced Analytics
3. Monitor Trends & Critical Events
4. Learn about Sumo’s Security and Compliance Apps
5. Next steps: where do you go from here?

3. Sumo Logic Confidential
Tutorial: Hands-on Exercises
Training Environment:
1. service.sumologic.com
2. The username and password is on your handout
Security Hands-on Labs:
● sumologic.com/learn/certifications

4. Sumo Logic Confidential
Sumo Logic Security Analytics
Real-time insights for streamlined Compliance and Security
• Meet compliance deadlines
• Reduce security risks
• Identify potential security breaches
• Neutralize new threat patterns
• Transform reactive/manual processes into integrated/proactive/automated
Automate Threat Detection
• Detect threats across microservices, container services, cloud-based
technology, operating systems, applications, storage devices, servers,
workstations, and more.

5. Sumo Logic Confidential
Examples of Security Use Cases
• Monitor “Root” Logins
• Monitor Multiple Failed Logins
• Monitor Web Activity
• Monitor Ingress/Outgress Rules
• Identify publicly exposed Security Group (0.0.0.0/0 with <open port>)
• Identify Services out of Compliance (no patches in “n” days)
• Identify Application Threats (Libraries, Botnets, compromised credentials)
• Monitor Malicious Threats and IOCs
➢ What’s your use case?

6. Sumo Logic Confidential
Filter and Provide Structure
Search and Parse

7. Sumo Logic Confidential
Search and Parse
Search and Filter your data
Search and Filter your data
• _metadata
• Keywords
• Live Tail
Parse fields to provide structure to your data
• Query Parsing
• Implement your Field Extraction Rules

8. Sumo Logic Confidential
Security Certification: Hands-on Labs
Labs 1-3: Search and Parse
• Search Basics: Metadata and Keywords
• Parsing Operators and Options
• Grouping Results
• Field Extraction Rules
Security Analytics

9. Sumo Logic Confidential
Conditional Logic, Filtering,
Formatting Results
Simple Analytics

10. Sumo Logic Confidential
Review ⇨ Query Syntax
Syntax: metadata
Keywords and operators, separated by pipes, that build on top of each other
|parse
|filter
|aggregate
|format
keywords

11. Sumo Logic Confidential
Simple Analytics
Aggregation
| count[]
| sum
| avg
| min()
| max()
Conditional
| if()
| []matches[]
| <>in()
| filter
| where
Formatting
| transpose
| fields
| limit
| sort by
| top

12. Sumo Logic Confidential
Cheat Sheet
Community
Learn Tab

13. Sumo Logic Confidential
Security Certification: Hands-On Labs
Lab 4A: Monitor AWS Root Account Usage
Community > Query Library > Security-related Queries for AWS
Security Analytics

14. Sumo Logic Confidential
Parse key fields
Perform additional
parsing on key fields
Don’t drop messages
that do not match
parse criteriaFurther Filter results
Aggregate by desired
fields
Filter using metadata and keywords

15. Sumo Logic Confidential
Security Certification: Hands-On Labs
Lab 4B: Monitor Security Groups Created
Community > Query Library > Security-related Queries for AWS
Security Analytics

16. Sumo Logic Confidential
Security Certification: Hands-On Labs
Lab 4C: Monitor “Impossible Travel” scenario
Community > Query Library > Security-related Queries for AWS
Security Analytics

17. Sumo Logic Confidential
Outliers, Trends,
Needle in the Haystack
Advanced Analytics

18. Sumo Logic Confidential
Advanced Analytics
Find the ”needle in the haystack” by identifying patterns.
Compare today’s patterns with patterns in the past.
_sourceCategory=Labs/security/snort
| logreduce
_sourceCategory=Labs/security/snort
| logcompare -24h
LogReduce ➜ New security
attacks/breaches.
LogCompare ➜ Compare
attacks/breaches to other time periods.

19. Sumo Logic Confidential
Advanced Analytics
_sourceCategory=Labs/AWS/CloudTrail
| parse ""eventName":"*"" as eventName nodrop
| parse ""responseElements":{"ConsoleLogin":"*"}" as loginResult nodrop
| where eventName="ConsoleLogin" and loginresult="Failure"
| timeslice 30m
| count(eventName) as failed_login_attempts by _timeslice
| outlier failed_login_attempts
_sourceCategory=Labs/security/Proofpoint and Mexico
| timeslice 5m
| count as rogue_traffic by _timeslice
| predict rogue_traffic by 5m forecast=12
Outlier ➜ Anomalies in number of Failed Logins
Predict ➜ Traffic from a Rogue Country/State

20. Sumo Logic Confidential
Advanced Analytics
_sourceCategory=Labs/PaloAltoNetworks and ",TRAFFIC,"
| where action="deny"
| count action
| compare with timeshift 15m 4 avg
| if(isNull(_count), 0, _count) as _count
| if(isNull(_count_60m_avg), 0, _count_60m_avg) as _count_60m_avg
| where _count>(5 * _count_60m_avg)
_sourceCategory=Labs/PaloAltoNetworks and ",TRAFFIC,"
| lookup latitude, longitude, country_code, country_name, city from geo://location on ip=dest_ip
| where country_code<>"US"
| count by latitude, longitude, country_code, country_name, city
Time Compare ➜ Identify a 5-fold increase in Denied Traffic
Geo Lookup ➜ Traffic Destinations outside the US

21. Sumo Logic Confidential
Security Certification: Hands-On Labs
Lab 5-8: Advanced Analytics
● Finding the needle in the haystack
● Comparing time periods
● Identifying Outliers
Security Analytics

22. Sumo Logic Confidential
Advanced Analytics
((_sourceCategory=Labs/PaloAltoNetworks ",THREAT,") or (_sourceCategory=Labs/PaloAltoNetworks ",TRAFFIC,"
action=allow))
| concat(dest_ip,":", dest_port) as destination
| transactionize src_ip (merge type, destination, src_ip takeFirst)
| where type matches "*TRAFFIC*" and type matches "*THREAT*"
| count src_ip, type, destination
| fields - _count
((_sourceCategory=Labs/security/snort "[Classification: Web Application Attack]") or
_sourceCategory=Labs/Apache/Access)
| parse "{TCP} *:* -> *:*" as src_ip, src_port, dest_ip, dest_port nodrop
| parse regex "(?<src_ip>d{1,3}.d{1,3}.d{1,3}.d{1,3})"
| transaction on src_ip
with states %"Labs/security/snort", %"Labs/Apache/Access" in _sourceCategory
| where %"Labs/security/snort">0 and %"Labs/Apache/Access">0
Transactionize ➜ Follow a Transaction
Transaction ➜ Correlate Traffic Data

23. Sumo Logic Confidential
Security Certification: Hands-On Labs
Labs 9-14: Lookups and Data Correlation
● Using Threat Intel Lookup
● Creating Query Templates
● Creating Custom Lookups
● Correlating Data
○ Transaction
○ Transactionize
○ Subqueries
Security Analytics

24. Sumo Logic Confidential
Dashboards and Alerts
Monitoring your Data

25. Sumo Logic Confidential
Monitoring Your Data
Visualize your data through Dashboards
● Chart your Data
● Create Panels
● Share your Content!
Receive notification of your Critical Events
● Schedule Your Searches
● Use Webhook Connections to reach your audience
● Create Meaningful Alerts

26. Sumo Logic Confidential
Security Certification: Hands-On Labs
Labs 15-18: Visualizing and Monitoring
● Create a Dashboard
● Add Panels to an Existing Dashboard
● Create Meaningful Alerts
Security Analytics

27. Sumo Logic Confidential
Out-of-the-Box Content
Security and
Compliance Apps

28. Sumo Logic Confidential
Security and
Compliance Apps
● Simplify Compliance
Management
● Set up Real-time
monitoring and Alerts
● Security Analytics with
Threat Intelligence

29. Sumo Logic Confidential
Apps: Palo Alto Networks
Discover threats, consumption, traffic patterns, and other security-driven issues, providing
additional insight for investigations.

30. Sumo Logic Confidential
Apps: AWS CloudTrail
Track user behavior patterns, administrator activity, or correlate with other data sets to
get a broader understanding of events from operating systems, intrusion detection
systems or application logs.

31. Sumo Logic Confidential
Apps: AWS VPC Flow Logs
Track your IP network traffic and troubleshoot security issues with real-time visibility and analysis of
your environment.

32. Sumo Logic Confidential
Apps: AWS GuardDuty
Detect unexpected and potentially malicious activities in your AWS account. Analyze threats by
severity, VPC, IP, account ID, region, and resource type. GuardDuty analyzes and processes VPC
Flow Logs and AWS CloudTrail event logs.

33. Sumo Logic Confidential
Apps: Threat Intelligence for AWS
Correlate CrowdStrike threat intelligence data with your AWS log data, for real-time security
analytics to detect threats and protect against cyber-attacks. The Threat Intel for AWS App scans
AWS CloudTrail, AWS ELB and AWS VPC Flow logs for threats based on IP address.

34. Sumo Logic Confidential
Apps: Threat Intelligence Quick Analysis
Correlate CrowdStrike threat intelligence data with your own log data, for real-time security
analytics to detect threats and protect against cyber-attacks. This app scans your selected logs for
threats based on IP, filename, URL, domain, Hash 256, and email.

35. Sumo Logic Confidential
Apps: CrowdStrike
Analyze CrowdStrike security events by type, status and detection method. The CrowdStrike
Falcon platform provides Endpoint Detection and Response, Antivirus and Threat Intelligence
services via the cloud.

36. Sumo Logic Confidential
Apps: O365
Monitor and analyze your complete Office 365 system for administrator and user activity. This app
monitors Audit logs for Azure Active Directory, Exchange and SharePoint.

37. Sumo Logic Confidential
Security Certification: Hands-On Labs
Labs 19-20: Sumo Logic Apps
● Installing AWS CloudTrail App
● Installing the Threat Intel App for OSSEC data
Using Sumo Logic

38. Sumo Logic Confidential
”How To” templates to implement in
your Environment
Use Cases

39. Sumo Logic Confidential
General Use Cases
How to Create and Alert on Ratios or Percentages
● Outlier
How to Compare and Alert on Historical Data
● Compare and Outlier
Detect Patterns and Changes Across Environments and Time
● LogCompare
Visualize Trends in Your Signatures
● LogReduce and Timeslice

40. Sumo Logic Confidential
Security Use Cases
● Security Queries for PAN (Firewalls)
● Security Queries for AWS
● Security Queries for Linux
● Security Queries for Windows

41. Sumo Logic Confidential
Training, Docs, Community, Support
Where do I go from here?

42. Need knowledge? ⇨ try the Learn tab
Explore the tutorials

43. Need knowledge? ⇨ try the Learn tab
Access comprehensive
lists of operators and
more
Explore the tutorials

44. Need knowledge? ⇨ try the Learn tab
Access comprehensive
lists of operators and
more
Every feature and tool
covered in docs
Explore the tutorials

45. Need knowledge? ⇨ try the Learn tab
Access comprehensive
lists of operators and
more
Every feature and tool
covered in docs
Find out What’s New
Explore the tutorials

46. Need knowledge? ⇨ try the Learn tab
Access comprehensive
lists of operators and
more
Every feature and tool
covered in docs
Find out What’s New
Find answers or post
your questions to
Community
Explore the tutorials

47. Need knowledge? ⇨ try the Learn tab
Access comprehensive
lists of operators and
more
Every feature and tool
covered in docs
Find out What’s New
Find answers or post
your questions to
Community
Attend/review training
and get certified
Explore the tutorials

48. Need knowledge? ⇨ try the Learn tab
Access comprehensive
lists of operators and
more
Every feature and tool
covered in docs
Find out What’s New
Find answers or post
your questions to
Community
Attend/review training
and get certified
Explore the tutorials
Open a Support case

49. Need knowledge? ⇨ try the Learn tab
Access comprehensive
lists of operators and
more
Every feature and tool
covered in docs
Find out What’s New
Find answers or post
your questions to
Community
Attend/review training
and get certified
Explore the tutorials
Open a Support case

50. Questions?

51. Security Labs
https://bit.ly/2MyZ7vi

52. Sumo Logic Confidential
Sumo Logic Confidential
In order to get credit for the exam,
In YOUR OWN INSTANCE, go to
Certification Tab.
• Online Exam
• 30 Multiple choice questions
• 60-minute time limit
• 3 attempts